If you didn’t approve the transaction, then your keys were compromised.
There are two manners in which this scenario may have played out.
- You, or somebody with access to your unlocked device, approved the transaction
- Your private key was compromised and an attacker approved this transaction on your behalf
In #2, if an attacker had compromised your keys, then they wouldn’t need to then interact with a scam website to drain your funds, they could just directly send the assets out, so that scenario seems unlikely.
Overall, you are responsible for safe private key practice, and you are responsible for determining the validity of transactions that you approve. There is no additional manner in which this scenario may have played out.